Privacy Policy

1.Personal Information We Collect#

Information You Provide

• Account and Registration Information. When you register for an account, we collect your name, email address, password, company name, company URL, phone number, and business address, and you may add company industry, billing address, time zone, and how you heard about us.

• Order Form and Contract Data. If your company enters a contractual relationship with us, we collect the name, job title, email address, and signature of the individual(s) signing on your company's behalf, and company name and address.

• Payment and Billing Information. If you subscribe to a paid plan, our third-party payment processor collects your payment details directly; we receive only the last four digits of your payment card, transaction date and amount, and related billing contact information.

• Communications and Support. When you contact us — including through our website, chat, email, or support portal, or to request a demo — we collect your name, email, phone number, company information, and the content of your inquiry.

• Marketing Subscriptions. If you sign up for our newsletter, blog, or other marketing communications, we collect your email address and communication preferences.

• Events, Webinars, and Surveys. If you register for an event or webinar, or respond to a survey, we collect the contact and other information you provide in that context.

Information We Collect Automatically

When you visit our website or use the Services, we and our service providers automatically collect certain information using cookies and similar technologies (such as pixels and local storage), including:

• Log Data: IP address, browser type and configuration, operating system, device identifiers, referring URL, and the date, time, and duration of your visit.

• Analytics Data: Pages viewed, features used, links clicked, and similar usage and engagement information.

• Approximate Location Data: Derived from your IP address.

For more information about our use of cookies and your choices, see Section 4 below.

Information From Other Sources

We may also receive personal information about you from business partners, resellers or referral partners, publicly available sources, and social media platforms (for example, if you interact with our page on a social network).

2.How We Use Personal Information#

We use personal information to: provide, maintain, and improve the Services; create and administer accounts; process payments; communicate with you, including responding to support requests and sending service-related notices; market our Services to you (where permitted, subject to your choices in Section 6); operate and improve our website, including through analytics; maintain the security and integrity of our Services and business; enforce our Terms of Service and other agreements; detect and prevent fraud or unlawful activity; and comply with our legal obligations.

3.How We Share Personal Information#

We may share personal information with:

• Service Providers. Vendors who perform services on our behalf, such as hosting, payment processing, customer support tooling, email delivery, and analytics, under confidentiality obligations and instructions to use the information only to provide those services.

• Professional Advisors. Lawyers, accountants, auditors, and similar advisors, as needed.

• Corporate Transactions. A successor or acquirer in connection with a merger, acquisition, financing, or sale of assets.

• Legal and Safety Purposes. Regulators, law enforcement, or other third parties where we believe disclosure is necessary to comply with the law, protect our rights or property, or protect the safety of any person.

• With Your Consent or Direction. Any other third party where you have directed or consented to the disclosure (for example, a published customer testimonial).

We do not sell your personal information, and we do not share it with third parties for cross-context behavioral advertising, in the sense those terms are used under the CCPA.

4.Cookies and Similar Technologies#

We use cookies and similar technologies on our website to operate the Services, remember your preferences, and understand how visitors use our website, including through Google Analytics. We do not use advertising or retargeting cookies or pixels. For visitors in the EEA, UK, or Switzerland, we provide a cookie consent mechanism for any non-essential cookies. You can also control cookies through your browser settings, though disabling cookies may affect the functionality of our website.

Do Not Track and Opt-Out Preference Signals. Some browsers offer a "Do Not Track" ("DNT") setting. There is no industry-standard response to DNT signals, and our website does not currently respond to them. Because we do not sell personal information or share it for cross-context behavioral advertising, there is no such activity for an opt-out preference signal (such as Global Privacy Control) to opt you out of; if that changes, we will update this Policy and honor those signals as required by law.

5.Automated Processing and AI Features#

Parts of the Services use machine learning and other automated techniques — for example, to analyze and organize review content, to surface reporting and insights, and to help detect fraud or abuse. Our Terms of Service describe how these AI features work in the customer relationship, including who owns the content they generate.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Where a merchant uses the Services to process information about its own customers, the merchant determines how that information is used, and the merchant's own privacy notice governs that processing.

6.Your Choices#

Marketing Emails. You can opt out of marketing emails at any time using the unsubscribe link in the email. You cannot opt out of service-related communications necessary to your use of the Services (e.g., billing notices, security alerts).

Account Information. You can review and update certain account information by logging into your account, or by contacting us at legal@lightningcommerce.ai.

7.Your Privacy Rights#

Depending on where you live, you may have the right to: request access to, and a copy of, the personal information we hold about you; request correction of inaccurate personal information; request deletion of your personal information, subject to certain exceptions; object to or restrict certain processing; and withdraw consent where processing is based on consent. Region-specific rights (including under the CCPA, other U.S. state privacy laws, and the GDPR) are described in Section 15.

To exercise these rights, contact us at legal@lightningcommerce.ai. We will need to verify your identity before responding, and may decline a request as permitted by law, in which case we will explain why.

8.Children's Privacy#

Our Services are business services and are not directed to children. We do not knowingly collect personal information from children under the age of 13 (or under 16 in the European Economic Area). If you believe a child has provided us with personal information, please contact us at legal@lightningcommerce.ai so we can delete it. Our Acceptable Use Policy separately restricts our customers from submitting children's information through the Services.

9.Third-Party Websites and Services#

Our website and Services may link to or integrate with third-party websites or services that we do not own or control, including commerce platforms and marketplaces such as TikTok Shop. This Privacy Policy does not apply to those third parties, and we encourage you to review their privacy notices.

10.Data Retention#

We retain personal information for as long as needed to provide the Services, comply with our legal obligations, resolve disputes, and enforce our agreements. In practice, we assess retention by considering the purpose of the record, the duration of the customer relationship, and applicable accounting, tax, and legal requirements. Customer Data we process as a processor is retained and deleted in accordance with our Data Processing Agreement with the applicable merchant.

11.International Data Transfers#

We are based in the United States, and personal information we collect may be transferred to, stored, and processed in the United States or other countries where we or our service providers operate. Where required, we rely on appropriate safeguards for such transfers, such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, consistent with our Data Processing Agreement.

12.Data We Process on Behalf of Our Business Customers#

If you are a customer, or a prospective customer, of one of the merchants that uses Lightning Commerce (for example, because you were asked to leave a product review through Lightning Reviews, your order was processed through Lightning Connector, or you submitted a return through Lightning Returns), the merchant — not Silk Commerce Corp. — is responsible for its own privacy notice and is the controller (or "business," under U.S. state privacy laws) of your personal information. We process that information solely as a processor, under that merchant's instructions and our Data Processing Agreement with them, which describes the categories of data involved, our security obligations, and how data subject rights requests are handled. If you have a question or request about how your information was used in connection with a purchase from one of our merchants, please contact that merchant directly; if you are unable to reach them, you may contact us at legal@lightningcommerce.ai and we will make reasonable efforts to direct your request appropriately.

13.Security#

We maintain technical and organizational measures designed to protect personal information, including the safeguards described in our Data Processing Agreement, and we maintain an information security management system certified to ISO/IEC 27001. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

14.Changes to This Privacy Policy#

We may update this Privacy Policy from time to time. If we make a material change, we will provide notice by posting the updated policy on our website with a new effective date, or through other appropriate means. Your continued use of the Services after the updated policy takes effect constitutes acceptance of the changes.

15.Region-Specific Disclosures#

California Residents#

These disclosures supplement this Privacy Policy and apply to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA").

Categories of Personal Information Collected (Last 12 Months): Identifiers (name, email, username); customer records (phone number, mailing address); commercial information (services purchased or considered); internet/network activity (device and usage data); geolocation data (approximate, from IP address); professional information (company, job title); sensitive personal information (as described below); and inferences drawn from the foregoing.

Sensitive Personal Information. We collect account log-in credentials — your username in combination with your password — which the CCPA treats as sensitive personal information. We use these credentials only to authenticate you and provide and secure the Services. We do not use or disclose them to infer characteristics about you, and we do not use them for any purpose that would require us to offer the right to limit their use under the CCPA.

Sources: Directly from you, automatically through your use of our website, and from business partners or publicly available sources, as described in Section 1.

Disclosures for a Business Purpose: We disclose the categories of personal information above to service providers, professional advisors, and, where applicable, in corporate transactions, as described in Section 3.

Sale or Sharing: As stated in Section 3, we do not sell personal information and do not share it for cross-context behavioral advertising.

Retention: We retain each category of personal information according to the criteria described in Section 10.

Your California Rights: Subject to certain exceptions, you have the right to know/access, correct, and delete your personal information; to opt out of any sale or sharing (which, as noted, we do not engage in); to limit use of sensitive personal information; to be free from discrimination for exercising these rights; and to designate an authorized agent to submit a request on your behalf. To exercise these rights, contact us at legal@lightningcommerce.ai. We will verify your identity before responding.

Other U.S. State Privacy Rights#

Residents of states with comprehensive privacy laws — including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and Montana, among others — may have rights to confirm whether we process their personal data and access it, correct inaccuracies, delete it, obtain a portable copy, and opt out of targeted advertising, sale, or certain profiling. As described above, we do not sell personal data or use it for targeted advertising.

Appeals. If we decline your privacy request, you may appeal that decision by replying to our response, or by writing to legal@lightningcommerce.ai with "Privacy Request Appeal" in the subject line. We will respond to an appeal within the period required by applicable law and explain our reasoning. If your appeal is denied, you may contact your state attorney general to submit a complaint.

European Economic Area, United Kingdom, and Switzerland#

If you are located in the EEA, UK, or Switzerland, the following supplement this Privacy Policy under the GDPR, UK GDPR, and Swiss FADP, as applicable.

Controller: Silk Commerce Corp., 47 Discovery, Suite 100, Irvine, CA 92782, is the controller of personal information described in this Privacy Policy (that is, where we do not act as a processor for a merchant under Section 12).

Legal Bases for Processing: We process personal information on the following legal bases, depending on the activity: performance of a contract (e.g., providing your account and the Services you request); our legitimate interests (e.g., securing our Services, marketing our Services to existing business contacts, and improving our website), balanced against your interests and rights; your consent (e.g., certain marketing communications or non-essential cookies, which you may withdraw at any time); and compliance with our legal obligations.

International Transfers: Personal information may be transferred to the United States and other countries as described in Section 11, subject to appropriate safeguards such as the Standard Contractual Clauses and, for UK transfers, the UK International Data Transfer Addendum.

Your Rights: Subject to applicable law, you have the right to access, rectify, erase, or restrict processing of your personal information; to data portability; to object to processing based on our legitimate interests or for direct marketing; to withdraw consent at any time without affecting prior processing; and to lodge a complaint with your local data protection supervisory authority. To exercise these rights, contact us at legal@lightningcommerce.ai.

16.Contact Us#

Silk Commerce Corp.
47 Discovery, Suite 100, Irvine, CA 92782
legal@lightningcommerce.ai
949-748-3700